Statute of the internal audit directorate in road infrastructure agency

STATUTE

Of

THE INTERNAL AUDIT DIRECTORATE
IN ROAD INFRASTRUCTURE AGENCY

Sofia
2020

Introduction

This statute describes the purpose, nature and role of the internal audit, the powers and responsibilities of the internal auditors and the management of the Road Infrastructure Agency /RIA/ in relation to the internal audit activity, as well as the relations between them.

The internal audit in the Road Infrastructure Agency is carried out by the Internal Audit Directorate, which is directly subordinated to the Management Board /MB/ of the Agency.

The Head of the Internal Audit (HIA) in RIA is the director of the Internal Audit Directorate.

I. NATURE AND ROLE OF INTERNAL AUDIT

Internal audit is an independent and objective assurance or advisory activity designed to benefit and improve the operations of the Road Infrastructure Agency.

The activity of the Internal Audit Directorate is carried out in accordance with the requirements of the Public Sector Internal Audit Act /PSIA/, International Standards for the Professional Practice in Internal Auditing / Standards /, the Code of Ethics of the Internal Auditors, the Statute of the Internal Audit Directorate and in compliance with the principles of:

1. Independence and objectivity
2. Competence and professional care
3. Integrity and confidentiality.

The role of internal audit is to help the agency achieve its objectives by applying a systematic and disciplinary approach to assessing and improving the effectiveness of risk management, control and governance processes.

The Internal Audit Directorate assists in achieving the goals and priorities of the RIA and assists the management of the agency by performing the following activities:

1. Evaluates the process of risk management in RIA and its compliance with the Financial Management and Control in the Public Sector Act /FMCPSA/, the methodology approved by the Minister of Finance and the Risk Management Strategy in the Road Infrastructure Agency, approved by the Acting Chair of the Management Board of the Agency.
2. Assess the adequacy and effectiveness of the financial management and control systems in RIA in relation to:

• risk identification, assessment and risk management by the management of RIA;
• compliance with legislation, internal acts and contracts;
• the reliability and comprehensiveness of financial and operational information;
• the efficiency, effectiveness and economy of activities and processes;
• protection of assets and information;
• the implementation of tasks and the achievement of goals.
   

3. Gives recommendations for improving the activities and processes in RIA.

Internal audit is carried out through the implementation of specific assurance and advisory audit engagements.

1. Audit Assurance Engagement – It is the provision of objective assessment of the evidence by internal auditors in order to provide an independent opinion or conclusion on a process, system or other entity, subject of audit. The nature, objectives and scope of the assurance engagement shall be determined by the Director of the Internal Audit Directorate. The assurance audit engagement is carried out mainly through: systems audit, audit on the compliance, performance audit, financial audit and information systems and technology audit.

The audit assurance engagement is announced by a notification letter addressed to the Acting Chair of the Management Board of RIA and to the head of the audited structure, activity and / or process.

The results of the performed activities on implementation of the audit engagement are documented in appropriate working documents, checked and approved by the Director of the Internal Audit Directorate and in accordance with the requirements of PSIA, the Standards and the methodology for internal audit in the public sector approved by the Minister of Finance.

In order to reflect the results of the audit engagement for assurance, an audit report is prepared, which is presented and discussed with the Acting Chair of the Board of RIA and the head of the audited structure, activity and / or process. The audit report is prepared in accordance with the requirements of PSIA and the Standards and includes a summary, objectives and scope of the engagement, findings, conclusions and recommendations. The report is prepared and signed by the team of auditors. The audit report is checked and approved by the Director of the Internal Audit Directorate, which is certified by signing a signature for agreement at the end of the report.

In preparing the audit report on the results of the engagement, the internal auditors note the good performance of the audited entity, in accordance with the requirements of the Standards.

2. Audit engagement for consulting – It is the provision of advice, opinion, training and others designed to improve risk management and control processes without internal auditors assuming managerial responsibility. An audit engagement for consulting is made on the initiative of the Acting Chair of the Board of RIA or by decision of the Board of the Agency. The nature, objectives and scope of the consulting engagement are determined jointly by the MB of RIA (respectively the Acting Chair of the Management Board) and the Director of the Internal Audit Directorate.

If necessary, and after an analysis of the needs for consulting, the Director of the Internal Audit Directorate may also initiate a proposal for a consulting engagement.

Audit engagement for consulting can be formal or informal.

Formal audit engagements for consulting may be included in the annual activity plan of the Internal Audit Directorate or may be initiated during the year, according to the needs of the RIA management.

Formal audit engagements for consulting are assigned by a decision of the Board of Directors of RIA, by Order of the Acting Chair of the Board of the Agency or by Resolution.

The working papers reflecting the results of the formal engagements for consulting may differ in form and content from the working papers used for assurance engagements, the specific form of which shall be determined according to the nature of the engagement and the professional judgement of the internal auditors and/or the Director of Internal Audit.

Reporting on formal audit engagements for consulting may take the form of a report, report note, opinion or other form, at the professional discretion of the internal auditors and the Director of the Internal Audit Directorate, and depending on the nature of the audit engagement and the needs of the Management.

The informal audit engagements for consulting are part of the ongoing work of internal auditors and may take the form of conversation, discussion, debate, expression of opinion, review of drafted documents, participation in a working group or other form and on matters for which the internal auditor concerned is competent. Informal engagements for consulting are made with the informed consent of the Director of Internal Audit.

Informal engagements for consulting may also be performed as part of an audit assurance engagement. The Director of the Internal Audit Directorate may approve the performance of informal consulting by internal auditors in the context of a specific audit engagement they are carrying out where, in the professional judgement of the auditors, the provision of advice or opinion on particular matters would be useful to the head and / or officials of the audited entity and would assist their better understanding of the issue concerned.

The Internal Audit Directorate maintains registers of assurance and audit engagements for consulting and a register summarizing the results of completed audit engagements.

II. Scope of Activity of the Internal Audit

The Internal Audit Directorate carries out the internal audit activity of all structures, programs, activities and processes in the Agency, including European funds and programs, and international projects.

The scope of the internal audit activity includes all units and structures of the Central Administration of RIA and all specialized units of the Agency (Appendix No. 1)

III. Independence

The Head of the internal audit (Director of the Directorate) ensures that the Internal Audit Directorate remains unaffected by any conditions that may impair the ability of internal auditors to perform their responsibilities impartially, including in terms of defining the purpose, scope, procedures, the frequency, and timing of audit engagements and the content of the audit report. If the head of the internal audit finds that independence or objectivity may be impaired, he shall immediately notify the MB of RIA.

Internal auditors maintain an impartial attitude that allows them to perform audit engagements objectively and in such a way as to believe in the results of their work, not to compromise on quality, and not to subject others to their audit judgment.

Internal auditors will not have direct operational responsibility or authority over any of the activities audited. Therefore, internal auditors will not apply internal controls, develop procedures, implement systems, or perform other activities that may impair their judgment, including:

• The internal auditor shall not perform an assurance engagement related to activities he has consulted or structures in which he has worked in the past year;
• Fulfillment of any operational obligations for RIA and in the organizations participating in interdepartmental programs or projects for the management of which the Agency is responsible.

The Internal Audit Directorate will perform its tasks efficiently and objectively only when it carries out its activities independently (without pressure or influence). The RIA Management Board ensures the independence of the Internal Audit Directorate by ensuring:

1. Direct subordination of the internal audit to the Management Board of RIA;

2. Providing a direct line of functional reporting, free and unrestricted access of the Director of the Internal Audit Directorate to the Acting Chair and the members of the Management Board of RIA, in accordance with the requirements of PSIA and the Standards, including:

• Presentation of the results of the audit engagements and reporting of all cases of identified indicators for fraud, the given recommendations and the actions taken to improve the activities and processes in the agency;
• Reporting on the adequacy of internal audit resources;
• Reporting on all cases in which the activity of the director of the directorate or the internal auditors has been restricted;
• Reporting on other significant issues related to the internal audit activity and at the professional discretion of the Director of the Internal Audit Directorate.

3. Implementation of functions and activities in the organization related only to the internal audit activity, without interfering with the planning, execution and reporting of the results of the audit engagements.

4. Free access to all heads of structures and employees in RIA, all assets of the agency and all documentation and information, including in electronic form, in connection with the audit activity in compliance with the restrictions or special order provided by law.

5. Appointment and dismissal of the Director of the Internal Audit Directorate and the Internal Auditors after written agreement with the Minister of Finance, in accordance with art. 21, para 5 of PSIA.

Internal auditors are required to:

• disclose any violation of independence or objectivity;
• show professional objectivity in collecting, evaluating and reporting information on the audited activity or process;
• assess all available and relevant facts and circumstances;
• take all necessary precautionary measures to avoid influencing their own interests or those of others in the performance of their professional duties and in making decisions.

The Head of Internal Audit – the Director of the Internal Audit Directorate shall:

• confirms before the RIA Management Board at least once a year the organizational independence of the internal audit;
• discloses to the RIA Management Board any interference and related consequences in determining the scope of internal audit, performance and / or reporting.

IV. RESPONSIBILITIES OF THE HEAD OF INTERNAL AUDIT AND INTERNAL AUDITORS

The Director of the Internal Audit Directorate and the internal auditors carry out the internal audit activity, as they are responsible for:

1. Compliance with PSIA, the Standards, the Code of Ethics of Internal Auditors, the Statute of the Internal Audit Unit and the methodology for internal audit in the public sector approved by the Minister of Finance.
2. Non-disclosure of information that became known to them in connection with their official activity, except in the cases provided by law.
3. Development of a Strategic Plan for the activities of the Internal Audit Directorate for a period of 3 / three / years, based on a risk assessment, which determines the strategic objectives and priorities of the internal audit activity, in accordance with the objectives of the Agency. The strategic plan is discussed with the management and other persons in managerial positions, submitted for approval by the RIA Management Board, after which it is approved by the Acting Chair of the Management Board. The strategic plan is reviewed and updated annually, as a result of changes in the objectives and priorities of the agency and on the basis of a risk assessment. At the end of the three-year period of the plan, a full reassessment of the risk is performed. The Director of the Internal Audit Directorate may, at his / her professional discretion, update the strategic plan more than once a year. All amendments and / or additions to the strategic plan are approved by the RIA Management Board and approved by the Acting Chair.
4. Preparation of an annual plan for the activities of the Internal Audit Directorate, based on the strategic plan and the risk assessment.

The annual plan is approved by the Management Board of RIA and approved by the Acting Chair of the Management Board. Prior to its approval by the RIA Management Board, the annual plan is coordinated with the Internal Audit Directorate at the Ministry of Regional Development and Public Works, in accordance with the requirements of PSIA and in order to ensure optimal scope of audit activities and minimal duplication of effort. The annual plan is reviewed on an ongoing basis during the year and is updated in the event of significant changes in the organization, regulations, composition of the directorate or other significant conditions, at the professional discretion of the director of the Internal Audit Directorate. All amendments and supplements to the annual plan are approved by the Board of RIA and approved by the Acting Chair.

The Director of the Internal Audit Directorate determines the audit techniques, oversees the work of the audit team and presents the results of the audit to management. The Director of the Internal Audit Directorate shall report in a timely manner to the MB of RIA any resource constraints needed in order to implement the annual plan.

5. Carrying out audit engagements for consulting at the initiative of the RIA Management Board. Before undertaking audit engagements for consulting, the Director of the Internal Audit Directorate should assess:

• Whether the internal auditors have the necessary knowledge and skills to perform the audit engagement.
• Whether the independence or objectivity of the internal auditors in relation to the provision of consulting services is likely to be compromised.

In the event that there is a possibility of impairment of independence and objectivity, the Management Board of RIA must be notified before accepting the consulting engagement.

6. Ensuring effective and efficient implementation of audit engagements and implementation of the audit plan.
7. Development and implementation of a program for quality assurance and improvement of the audit activity, including internal and external evaluations.
8. Timely reporting of the results of the audit engagements to the Acting Chair of the Management Board of RIA and monitoring the implementation of the recommendations given in the audit reports.
9. Introduction of internal rules and procedures for the application of legal requirements, Standards, manuals, instructions and methodology, according to the specifics of the organization.
10. Effective implementation of the Annual Plan and audit engagements
11. Follow-up of recommendations and measures taken and periodically report to the head of the organization on all measures that have not been effectively implemented.
12. Planning and taking measures to ensure that the internal audit of RIA collectively possesses or acquires knowledge, skills and other competencies necessary to meet the requirements of PSIA, the Standards, the Statute and the methodology for internal audit in the public sector.

V. REPORTING

V.1. The Director of the Internal Audit Directorate:

1. Prepares periodic reports (quarterly or for another period of time) on the activities of the Internal Audit Directorate, which are presented and discussed with the Management Board of RIA. The reports shall present the performed audit activity for the respective period, as well as other issues at the professional discretion of the Director of the Internal Audit Directorate.

2. Prepares the Annual Report on the Activity of the Internal Audit Directorate, which shall be submitted to the RIA Management Board no later than January 30 of the respective year following the year to which the report relates.

3. Reports the results of the audit engagements, the given recommendations and the results of monitoring the implementation of the given recommendations to the Acting Chair of the Board of RIA.

4. Reports to the Acting Chair of the Management Board of RIA all cases that violate the organizational and functional independence of the Internal Audit Directorate, as well as all cases in which the activity of internal audit is limited.

5. Immediately notifies the Acting Chair of the Management Board of RIA of fraud indicators identified by the internal auditors and proposes measures to be taken and to notify the relevant competent authorities.

6. Notifies the relevant competent authorities when the Acting Chair of the Management Board of RIA does not take action within 14 days of reporting the identified indicators of fraud.

7. If necessary, attends the meetings of the Management Board of RIA and discusses and reports on issues related to internal audit activities.

8. Holds meetings with the Acting Chair and / or the members of the Management Board of RIA on issues related to the internal audit activity.

9. Provides documentation stored in the internal audit unit to the Acting Chair of the Management Board of RIA or to officials authorized by him (for each specific case) upon official written request.

V.2. The Internal Auditors of the Internal Audit Directorate:

1. Report to the Director of the Internal Audit Directorate the results of the implementation of the audit engagements for assurance and consultation, in the order and manner specified in the Internal Rules of Procedure of the Internal Audit Directorate.

2. Monitor the implementation of the given recommendations by assessing the adequacy, effectiveness and timeliness of the actions taken and report the results to the Director of the Internal Audit Directorate and the Acting Chair of the Management Board of RIA.

3. Report immediately to the Director of the Internal Audit Directorate on identified fraud indicators.

4. Report to the Director of the Internal Audit Directorate all cases in which the audit activity is limited.

5. They report to the Director of the Internal Audit Directorate on other significant issues, in their professional judgment, related to the performed audit activity.

VI. RESPONSIBILITIES OF THE MANAGEMENT BOARD OF THE ROAD INFRASTRUCTURE AGENCY WITH REGARD TO THE INTERNAL AUDIT ACTIVITY

1. The Management Board of RIA shall create conditions for effective and qualitative implementation of the internal audit activity in accordance with the PSIA, the Standards, the Code of Ethics of the Internal Auditors, the Statute of the Internal Audit Directorate and the Methodology for Internal Audit in the Public Sector approved by the Minister of Finance, ensuring:

• The independence of the internal audit in planning, performing and reporting the results of audit engagements and preventing interference in determining the scope of activities, performance of audit work and presentation of results;
• All necessary resources (personnel, technical and office equipment, work premises, communications, etc.), within the available possibilities, for effective and quality implementation of the audit activity;
• The participation of internal auditors in training events in order to maintain high professional competence;
• The appointment of expert/s, when special knowledge and skills related to the implementation of a specific audit engagement are required and after a proposal by the Director of the Internal Audit Directorate;
• The assistance of all officials in the RIA (Central Administration and specialized units) in carrying out the audit activity.

2. The Management Board of RIA may not assign the Director of the Internal Audit Directorate and the internal auditors to perform activities and functions other than the internal audit activity.
3. By decision of the Management Board of RIA, the following are endorsed and approved by the Acting Chair of the Management Board:

• The strategic plan for the internal audit activity;
• The annual activity plan of the Internal Audit Directorate, containing the specific audit engagements that are planned to be implemented in the respective year;
• The program for quality assurance and improvement;
• The annual training plan for internal auditors.

4. The Acting Chair of the Management Board of RIA shall notify the relevant competent authorities in case of identified fraud indicators reported by the Director of the Internal Audit Directorate.
5. The Acting Chair of the Management Board of RIA shall present the audit reports to the Minister of Finance, when this envisaged in an administrative act of the Council of Ministers, in another normative act and / or instructions of the Ministry of Finance.
6. The Acting Chair or a member of the Management Board of RIA, in accordance with the powers delegated to him / her, approves the action plans prepared by the heads of audited structures for the implementation of the given recommendations.
7. The Acting Chair of the Management Board of RIA shall ensure the provision to the Director of the Internal Audit Directorate of the reports of audits, inspections and/or other assessments carried out by the Bulgarian National Audit Office, the State Financial Inspection Agency, the Audit of European Union Funds Executive Agency, the Managing Authorities of the Operational Programs and others, in order to coordinate the activities of the Directorate with those of the external control bodies, to ensure optimal coverage of the audit activities carried out in RIA and minimum duplication of efforts.
8. The Acting Chair of the Management Board of RIA shall ensure the provision to the Internal Audit Directorate of all instructions, manuals, guidelines and other methodology for internal audit in the public sector, sent by the Ministry of Finance.
9. The Acting Chair of the Management Board of RIA sends the annual report on the activities of the Internal Audit Directorate to the Ministry of Regional Development and Public Works, in accordance with the requirements of PSIA by January 31 of the respective year which follows the year to which the report relates.

VII. INTERACTION WITH OTHER ORGANIZATIONS

The Director of the Internal Audit Directorate shall coordinate the interaction with external auditors and representatives of other control bodies, providing them, where necessary, with information on the strategic and annual internal audit work plan, reports on audit engagements, opinions and other information related to the audit activity.

When planning audit engagements related to interdepartmental programs and projects, the director of the Internal Audit Directorate coordinates the annual plan with the internal audit units in the organizations involved in the implementation of these programs and projects.

The Director of the Internal Audit Directorate prepares for submission by the Acting Chair of the Management Board of RIA all the necessary documents and information required by the Ministry of Finance, which relate to the audit activities carried out in RIA.

The internal auditors of the directorate communicate with auditors from the internal audit units of other organizations in order to exchange good practices and discuss issues and matters related to the activity of internal audit in the public sector. The communication is coordinated with the Director of the Internal Audit Directorate.

VIII. MONITORING

The statute of the Internal Audit Directorate is subject to periodic review and evaluation, in order to ensure that it is adequate, it assists the internal audit in achieving its objectives.

The periodic monitoring of the statute is carried out by the Director of the Internal Audit Directorate. The periodic review and evaluation is performed at least once a year, and the results are documented in an appropriate manner, at the professional discretion of the Director of the Directorate. If necessary and / or in case of change of internal or external factors influencing the activity of internal audit in RIA, the Director of the Internal Audit Directorate initiates amendments and / or supplements to the statute, which he presents and discusses with the Acting Chair of the Management Board of RIA. In order to increase the efficiency of the audit activity, the RIA management may also make proposals for amendment and / or supplementation of the Statute.

FINAL PROVISIONS

§ 1. The Statute of the Internal Audit Directorate in the Road Infrastructure Agency has been prepared on the basis of Art. 27, para 1, item 1 of PSIA and standard No. 1000 of the Standards.

§ 2. This Statute was approved by a decision of the Board of RIA, documented in Protocol № 25490/20 of 17.06.2020 and enters into force on the same date.

§ 3. This statute repeals the statute of the Internal Audit Directorate, approved by the Acting Chair of the Board of RIA on 27.06.19.

§ 4. Amendments and / or supplements to the statute may be discussed and made at the initiative of the Director of the Internal Audit Directorate and the management of the RIA, in the order of its adoption.

NADKA HRISTOVA                                               GEORGI TERZIYSKI
Director of Internal Audit Directorate                   Acting Chair of the Management Board
Signature: Ill.                                                            Of the Road Infrastructure Agency
                                                                                    Signature: Ill.
                                                                                    Seal: Road Infrastructure Agency

Date: 17.06.2020                                                        Date: 17.06.2020

Appendix No. 1

Structures and units of the Central Administration of the Road Infrastructure Agency:

1. Secretary General;
2. Financial auditors;
3. Internal Audit Directorate
4. Officer on Information Security;

General administration:

5. Administrative Services, Human Resources and Property Management Directorate;
6. Communications and Information Directorate;
7. Public Procurement and Legal Service Directorate;
8. Budget, Finance and Settlements of Projects Directorate;
9. Information Technologies and Systems Directorate;

Specialized administration

10. Maintenance of the Road Infrastructure Directorate;
11. Investment Design and Land Acquisition Procedures Directorate;
12. Implementation of projects under the operational program “Growing Regions 2014-2020” and under the programs for territorial cooperation of the European Union Directorate;
13. Implementation of projects under OP Transport and Transport Infrastructure 2014-2020 Directorate;
14. Risk Analysis and Operational Control Directorate;
15. Road Charges and Permits Directorate.
16. Management of Strategic Infrastructure Projects Directorate;
17. Road Safety and Planning of the Activities on the Republican Road Network      Directorate

Specialized units of the Road Infrastructure Agency

1. 27 / twenty-seven / Regional Road Administrations;
2. Road and Bridges Institute
3. National Toll Administration